@reventlessdev/reventless-aws 3.0.0-alpha.319 → 3.0.0-alpha.320

package/src/adapter/Auth/Auth_ActiveRolePoolAttachment.res

@@ -16,6 +16,16 @@
     never a hand-run command against a live pool, which would leave the
     deployment's behaviour depending on an act no source describes.
 
+    🚨 **The slot is the pool's, and this resource takes it only when it is
+    free or already ours.** Cognito allows a pool exactly one
+    `PreTokenGeneration` trigger, so an unconditional attach is last-writer-wins:
+    it silently replaces a BYO customer's own claims-enrichment trigger, and it
+    lets two platform stacks sharing a pool each read a store the other never
+    writes — every role switch reporting success and doing nothing. So the
+    describe this already performs is also read for *what is attached*, and a
+    slot held by anything else fails the deploy naming it. See [classifySlot] and
+    [docs/plans/active-role-store-scoped-to-the-pool.md].
+
     🚨 **`UpdateUserPool` resets by omission.** The API requires "a value for all
     parameters that you don't want set to a default value". An attach that sends
     only `LambdaConfig` silently returns every other setting on that pool to its
@@ -135,10 +145,33 @@ let mergedUpdateInput = (
   out
 }
 
-/** The trigger currently attached to a described pool, if any.
+/** Whatever function currently holds the pool's pre-token-generation slot,
+    regardless of the contract version it is held at.
+
+    Prefers `PreTokenGenerationConfig`, since that is the field AWS populates.
+
+    Version-blind on purpose, and that is what separates it from
+    [attachedTrigger]: this answers "is the slot occupied, and by whom" — the
+    question the takeover check asks. A foreign trigger pinned at `V2_0` is very
+    much attached, and a reader that reported it as absent would have this
+    resource quietly replace exactly the trigger it is meant to refuse. */
+let attachedTriggerArn = (~described: dict<JSON.t>): option<string> => {
+  let lambdaConfig = described->Dict.get("LambdaConfig")->Option.flatMap(JSON.Decode.object)
+  switch lambdaConfig
+  ->Option.flatMap(c => c->Dict.get("PreTokenGenerationConfig"))
+  ->Option.flatMap(JSON.Decode.object)
+  ->Option.flatMap(config => config->Dict.get("LambdaArn"))
+  ->Option.flatMap(JSON.Decode.string) {
+  | Some(_) as arn => arn
+  | None =>
+    lambdaConfig
+    ->Option.flatMap(c => c->Dict.get("PreTokenGeneration"))
+    ->Option.flatMap(JSON.Decode.string)
+  }
+}
 
-    Prefers `PreTokenGenerationConfig`, since that is the field AWS populates and
-    the one that carries the version.
+/** The trigger currently attached to a described pool **at a version this
+    handler implements**, if any.
 
     A pool whose `LambdaVersion` names a contract [triggerVersion] does not
     implement reports `None` — *not attached* — even when it points at our own
@@ -163,6 +196,83 @@ let attachedTrigger = (~described: dict<JSON.t>): option<string> => {
   }
 }
 
+// ── Whose slot is it ─────────────────────────────────────────────────────────
+
+/** What this deployment found in the pool's one pre-token-generation slot. */
+type slot =
+  /** Nothing attached. */
+  | Vacant
+  /** This deployment's own trigger. */
+  | Ours
+  /** Another deployment's active-role trigger, reading the **same** store.
+
+    Not a conflict. Two platform stacks sharing a pool run the same code over the
+    same rows, so whichever holds the slot serves both — which is the whole point
+    of naming one store with `platform:activeRoleStore`. */
+  | SharedWith(string)
+  /** Another deployment's active-role trigger, reading a **different** store.
+
+    The defect itself, caught at the only moment anything can see both halves:
+    this stack's write door would write rows that trigger never reads. */
+  | DifferentStore({arn: string, theirStore: string})
+  /** Something that is not one of ours at all. */
+  | Foreign(string)
+
+/**
+Which of the five a described pool presents.
+
+Pure and total, like [mergedUpdateInput] and [probeVerdict], so every branch is
+checkable without a pool. `attachedStore` is the `ACTIVE_ROLE_TABLE` the attached
+function is configured with — `None` when it carries none, or when it could not
+be read at all.
+
+Reading the *store* rather than matching a function name is what makes this a
+check on the invariant rather than on a convention: two triggers agree exactly
+when the rows they read are the rows the other's resolver writes, and that is a
+fact about their configuration, not about what they are called.
+*/
+let classifySlot = (
+  ~attachedArn: option<string>,
+  ~ourArn: string,
+  ~ourStore: string,
+  ~attachedStore: option<string>,
+): slot =>
+  switch attachedArn {
+  | None | Some("") => Vacant
+  | Some(arn) if arn == ourArn => Ours
+  | Some(arn) =>
+    switch attachedStore {
+    | Some(store) if store == ourStore => SharedWith(arn)
+    | Some(store) => DifferentStore({arn, theirStore: store})
+    | None => Foreign(arn)
+    }
+  }
+
+/**
+The sentence to fail the deploy with, or `None` to proceed.
+
+🚨 **The same trade [readOnlyKeys] makes.** Today this resource replaces whatever
+it finds, so a BYO customer's own claims-enrichment trigger is silently detached
+by a deploy — on a pool the framework went to considerable lengths not to
+otherwise disturb. Given "a customer's pool quietly loses a trigger" and "the
+deploy fails naming what is in the way", the second is the one to design for.
+
+Both refusals name what is attached, because the operator cannot act on either
+without knowing which function holds the slot.
+*/
+let refusalFor = (~slot: slot, ~userPoolId: string, ~ourStore: string): option<string> =>
+  switch slot {
+  | Vacant | Ours | SharedWith(_) => None
+  | DifferentStore({arn, theirStore}) =>
+    Some(
+      `user pool ${userPoolId} already carries the active-role trigger ${arn}, which reads "${theirStore}" — but this deployment's Platform_SetActiveRole writes "${ourStore}". A pool holds one pre-token-generation trigger, so attaching would leave one of the two stacks writing rows nothing reads and every role switch silently doing nothing. Point both stacks at one store with platform:activeRoleStore, or give them separate user pools.`,
+    )
+  | Foreign(arn) =>
+    Some(
+      `user pool ${userPoolId} already carries the pre-token-generation trigger ${arn}, which is not an active-role trigger of this framework — attaching would silently replace it, and Cognito allows a pool only one. Detach it deliberately if it is obsolete, or give this deployment its own user pool. (If it *is* a Reventless trigger, this deployment could not read its configuration: the deploying principal needs lambda:GetFunctionConfiguration on it.)`,
+    )
+  }
+
 // ── AWS SDK bindings (lazily imported — see AppSync_SourceApiAssociation_Retrying) ──
 
 type cognitoClient
@@ -222,9 +332,12 @@ let getClient = async (): cognitoClient =>
 type lambdaClient
 type invokeCmd
 
+type configCmd
+
 type lambdaSdkModule = {
   @as("LambdaClient") clientCtor: unit => lambdaClient,
   @as("InvokeCommand") invokeCtor: dict<JSON.t> => invokeCmd,
+  @as("GetFunctionConfigurationCommand") configCtor: dict<JSON.t> => configCmd,
 }
 
 type invokeResult = {
@@ -232,7 +345,10 @@ type invokeResult = {
   @as("Payload") payload?: JSON.t,
 }
 
+type configResult = {@as("Environment") environment?: JSON.t}
+
 @send external sendInvoke: (lambdaClient, invokeCmd) => promise<invokeResult> = "send"
+@send external sendGetConfig: (lambdaClient, configCmd) => promise<configResult> = "send"
 @val external dynImportLambda: string => promise<lambdaSdkModule> = "import"
 
 let _lambdaSdk: ref<option<lambdaSdkModule>> = ref(None)
@@ -257,6 +373,33 @@ let getLambdaClient = async (): lambdaClient =>
     c
   }
 
+/** The store an already-attached function reads, from its own configuration.
+
+    `None` covers three cases on purpose — no `Environment`, no
+    `ACTIVE_ROLE_TABLE` in it, and the call failing outright (a deleted function,
+    a cross-account ARN, a deploying principal without
+    `lambda:GetFunctionConfiguration`). All three mean the same thing here: this
+    deployment cannot establish that the attached trigger reads what its own
+    resolver writes, and [refusalFor]'s `Foreign` sentence names every one of
+    them. Failing closed is the point — the alternative is taking the slot on the
+    strength of a lookup that did not happen. */
+let activeRoleStoreOf = async (~functionArn: string): option<string> =>
+  try {
+    let sdk = await getLambdaSdk()
+    let client = await getLambdaClient()
+    let input = Dict.make()
+    input->Dict.set("FunctionName", JSON.Encode.string(functionArn))
+    let result = await client->sendGetConfig(newOf1(sdk.configCtor, input))
+    result.environment
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.flatMap(env => env->Dict.get("Variables"))
+    ->Option.flatMap(JSON.Decode.object)
+    ->Option.flatMap(vars => vars->Dict.get("ACTIVE_ROLE_TABLE"))
+    ->Option.flatMap(JSON.Decode.string)
+  } catch {
+  | _ => None
+  }
+
 /** Decodes the SDK's `Payload`, which arrives as a byte array rather than a
     string. */
 let decodePayload: JSON.t => string = %raw(`(p) => {
@@ -282,6 +425,11 @@ let isPoolGoneError = (jsErr: JsExn.t): bool =>
     is here to check. */
 let probeSubject = "reventless-attachment-probe"
 
+/** The app client the probe presents, and like [probeSubject] it must match no
+    real one — together they form the row key, and a collision would exercise a
+    stored preference rather than the empty path this is checking. */
+let probeClientId = "reventless-attachment-probe-client"
+
 /** A minimal `V1_0` pre-token-generation event.
 
     Empty membership on purpose — with no groups and no stored role there is
@@ -300,11 +448,19 @@ let probeEvent = (~userPoolId: string): JSON.t => {
   request->Dict.set("userAttributes", JSON.Encode.object(userAttributes))
   request->Dict.set("groupConfiguration", JSON.Encode.object(groupConfiguration))
 
+  // Carried because Cognito carries it, and the handler keys its row on it. A
+  // probe without one takes the "no client id, nothing to look up" branch and
+  // would report a function healthy without ever reaching the store — proving
+  // less than it appears to.
+  let callerContext = Dict.make()
+  callerContext->Dict.set("clientId", JSON.Encode.string(probeClientId))
+
   let event = Dict.make()
   event->Dict.set("version", JSON.Encode.string("1"))
   event->Dict.set("triggerSource", JSON.Encode.string("TokenGeneration_Authentication"))
   event->Dict.set("userPoolId", JSON.Encode.string(userPoolId))
   event->Dict.set("userName", JSON.Encode.string(probeSubject))
+  event->Dict.set("callerContext", JSON.Encode.object(callerContext))
   event->Dict.set("request", JSON.Encode.object(request))
   event->Dict.set("response", JSON.Encode.object(Dict.make()))
   JSON.Encode.object(event)
@@ -406,23 +562,72 @@ let describePool = async (~userPoolId: string): option<dict<JSON.t>> => {
   result.userPool->Option.flatMap(JSON.Decode.object)
 }
 
-/** Set (or clear) the pool's pre-token-generation trigger, preserving every
-    other setting the pool carries. */
-let applyTrigger = async (~userPoolId: string, ~preTokenGenerationArn: option<string>): unit => {
+/** Send the merge for an already-described pool. */
+let sendMerged = async (
+  ~described: dict<JSON.t>,
+  ~userPoolId: string,
+  ~preTokenGenerationArn: option<string>,
+): unit => {
   let sdk = await getSdk()
   let client = await getClient()
+  let input = mergedUpdateInput(~described, ~userPoolId, ~preTokenGenerationArn)
+  await client->sendUpdate(newOf1(sdk.updateCtor, input))
+}
+
+/** Describe succeeded but returned no pool body. Sending an update built from
+    nothing is precisely the reset this resource exists to avoid. */
+let throwOnEmptyDescribe = (~userPoolId: string) =>
+  JsError.throwWithMessage(
+    `DescribeUserPool returned no pool for "${userPoolId}"; refusing to send an UpdateUserPool that would reset it`,
+  )
+
+/**
+Attach this deployment's trigger — after establishing that the slot is this
+deployment's to take.
+
+The order is the whole design. Describe once, then in turn: refuse a slot held by
+a trigger that is not ours or reads a different store; prove our own function can
+run; only then write. Every refusal happens before any `UpdateUserPool`, so a
+pool that fails this is left exactly as it was found.
+*/
+let attachTrigger = async (
+  ~userPoolId: string,
+  ~preTokenGenerationArn: string,
+  ~activeRoleStore: string,
+): unit =>
   switch await describePool(~userPoolId) {
-  | None =>
-    // Describe succeeded but returned no pool body. Sending an update built from
-    // nothing is precisely the reset this resource exists to avoid.
-    JsError.throwWithMessage(
-      `DescribeUserPool returned no pool for "${userPoolId}"; refusing to send an UpdateUserPool that would reset it`,
-    )
+  | None => throwOnEmptyDescribe(~userPoolId)
   | Some(described) =>
-    let input = mergedUpdateInput(~described, ~userPoolId, ~preTokenGenerationArn)
-    await client->sendUpdate(newOf1(sdk.updateCtor, input))
+    let attachedArn = attachedTriggerArn(~described)
+    // Only for a slot held by something other than us — our own function's store
+    // is the one we were handed, so asking AWS about it would prove nothing and
+    // cost a call on the common path.
+    let attachedStore = switch attachedArn {
+    | Some(arn) if arn != preTokenGenerationArn && arn != "" =>
+      await activeRoleStoreOf(~functionArn=arn)
+    | _ => None
+    }
+    let slot = classifySlot(
+      ~attachedArn,
+      ~ourArn=preTokenGenerationArn,
+      ~ourStore=activeRoleStore,
+      ~attachedStore,
+    )
+    switch refusalFor(~slot, ~userPoolId, ~ourStore=activeRoleStore) {
+    | Some(message) => JsError.throwWithMessage(message)
+    | None => ()
+    }
+    switch slot {
+    | SharedWith(arn) =>
+      log.info(
+        ~comp="Auth_ActiveRolePoolAttachment",
+        `user pool ${userPoolId} carries active-role trigger ${arn} from another deployment, reading the same store "${activeRoleStore}" — taking the slot serves both`,
+      )
+    | _ => ()
+    }
+    await verifyTrigger(~userPoolId, ~preTokenGenerationArn)
+    await sendMerged(~described, ~userPoolId, ~preTokenGenerationArn=Some(preTokenGenerationArn))
   }
-}
 
 // ── Dynamic provider ─────────────────────────────────────────────────────────
 
@@ -437,12 +642,19 @@ type providerInputs = {
       function once, on the deploy that created it, and never for any version
       shipped afterwards. A check that only ever runs once is not a check. */
   codeHash: string,
+  /** The store this deployment's trigger reads and its write door writes.
+
+      Carried so the takeover check can compare it against the store of whatever
+      already holds the pool's slot — the comparison that decides whether two
+      deployments sharing this pool agree or silently disagree. */
+  activeRoleStore: string,
 }
 
 type createOuts = {
   userPoolId: string,
   preTokenGenerationArn: string,
   codeHash: string,
+  activeRoleStore: string,
 }
 
 type createResult = {id: string, outs: createOuts}
@@ -451,13 +663,10 @@ type diffResult = {changes: bool, replaces: array<string>, deleteBeforeReplace:
 type readResult = {id?: string, props?: createOuts}
 
 let create = async (inputs: providerInputs): createResult => {
-  await verifyTrigger(
+  await attachTrigger(
     ~userPoolId=inputs.userPoolId,
     ~preTokenGenerationArn=inputs.preTokenGenerationArn,
-  )
-  await applyTrigger(
-    ~userPoolId=inputs.userPoolId,
-    ~preTokenGenerationArn=Some(inputs.preTokenGenerationArn),
+    ~activeRoleStore=inputs.activeRoleStore,
   )
   {
     id: inputs.userPoolId,
@@ -465,27 +674,28 @@ let create = async (inputs: providerInputs): createResult => {
       userPoolId: inputs.userPoolId,
       preTokenGenerationArn: inputs.preTokenGenerationArn,
       codeHash: inputs.codeHash,
+      activeRoleStore: inputs.activeRoleStore,
     },
   }
 }
 
 let update = async (_id: string, _olds: createOuts, news: providerInputs): updateResult => {
-  // Re-proved on every update, not only on create: the usual reason this runs is
-  // that the function's code changed, which is exactly when it might have stopped
-  // working. The pool keeps the trigger it already has until this succeeds.
-  await verifyTrigger(
+  // Re-checked and re-proved on every update, not only on create: the usual
+  // reason this runs is that the function's code changed, which is exactly when
+  // it might have stopped working — and a slot this deployment held once can
+  // have been taken since. The pool keeps the trigger it already has until this
+  // succeeds.
+  await attachTrigger(
     ~userPoolId=news.userPoolId,
     ~preTokenGenerationArn=news.preTokenGenerationArn,
-  )
-  await applyTrigger(
-    ~userPoolId=news.userPoolId,
-    ~preTokenGenerationArn=Some(news.preTokenGenerationArn),
+    ~activeRoleStore=news.activeRoleStore,
   )
   {
     outs: {
       userPoolId: news.userPoolId,
       preTokenGenerationArn: news.preTokenGenerationArn,
       codeHash: news.codeHash,
+      activeRoleStore: news.activeRoleStore,
     },
   }
 }
@@ -494,10 +704,29 @@ let update = async (_id: string, _olds: createOuts, news: providerInputs): updat
     of the stack; a pool left pointing at a deleted function fails **every**
     sign-in, and it is a pool the framework does not own — so nothing else in
     this deployment would ever put it right. A pool that has already gone is
-    nothing to detach from. */
+    nothing to detach from.
+
+    🚨 **Only when the slot still holds *our* function.** Where two stacks share
+    a pool the later one takes the slot, and a blind detach here would then tear
+    out a trigger this deployment does not own while destroying — reintroducing
+    the outage this exists to prevent, from the opposite direction. What is left
+    behind in that case is a healthy trigger reading the store both stacks share. */
 let delete_ = async (_id: string, props: createOuts): unit =>
   try {
-    await applyTrigger(~userPoolId=props.userPoolId, ~preTokenGenerationArn=None)
+    switch await describePool(~userPoolId=props.userPoolId) {
+    | None => throwOnEmptyDescribe(~userPoolId=props.userPoolId)
+    | Some(described) =>
+      switch attachedTriggerArn(~described) {
+      | Some(arn) if arn == props.preTokenGenerationArn =>
+        await sendMerged(~described, ~userPoolId=props.userPoolId, ~preTokenGenerationArn=None)
+      | Some(arn) =>
+        log.info(
+          ~comp="Auth_ActiveRolePoolAttachment",
+          `user pool ${props.userPoolId} carries ${arn}, not this deployment's trigger; leaving it attached`,
+        )
+      | None => ()
+      }
+    }
   } catch {
   | exn if exn->JsExn.fromException->Option.mapOr(false, isPoolGoneError) =>
     log.info(
@@ -508,13 +737,15 @@ let delete_ = async (_id: string, props: createOuts): unit =>
 
 /** A different pool is a different attachment: the old pool must be detached
     before the new one is attached, so this replaces rather than updates in
-    place. Changing only the function ARN is an ordinary update. */
+    place. Changing only the function ARN, its code, or the store it reads is an
+    ordinary update — each is a reason to run the takeover check again. */
 let diff_ = (_id: string, olds: createOuts, news: providerInputs): diffResult => {
   let poolChanged = olds.userPoolId != news.userPoolId
   {
     changes: poolChanged ||
     olds.preTokenGenerationArn != news.preTokenGenerationArn ||
-    olds.codeHash != news.codeHash,
+    olds.codeHash != news.codeHash ||
+    olds.activeRoleStore != news.activeRoleStore,
     replaces: poolChanged ? ["userPoolId"] : [],
     deleteBeforeReplace: true,
   }
@@ -536,6 +767,9 @@ let read_ = async (id: string, props: createOuts): readResult =>
           // recorded hash is carried through unchanged. Refresh answers "is the
           // right function attached", which is what the pool actually knows.
           codeHash: props.codeHash,
+          // Likewise not the pool's to report — it is a property of whatever
+          // function holds the slot, and refresh is about the pool.
+          activeRoleStore: props.activeRoleStore,
         },
       }
     }
@@ -561,6 +795,7 @@ type constructorProps = {
   userPoolId: Pulumi.Input.t<string>,
   preTokenGenerationArn: Pulumi.Input.t<string>,
   codeHash: Pulumi.Input.t<string>,
+  activeRoleStore: Pulumi.Input.t<string>,
 }
 
 // Explicit /index.js path because @pulumi/pulumi/dynamic is a directory import